7de8d603e644b057b082e7932689431d064ffefa0c3b2861edb76818c002e3d3

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79d49f5ee6ead95c096d3c186169d47c.exe
Size

16KB
MD5

79d49f5ee6ead95c096d3c186169d47c
SHA1

f75d5bf3f44ab7dbdb446944c7abed25aa5b6168
SHA256

7de8d603e644b057b082e7932689431d064ffefa0c3b2861edb76818c002e3d3
SHA512

f9780fb7973d0f95076bd9fd04b02cea3084e950c7e7c3f47af850a862aec0636a25a90879f54cc28f923688190c0e6ff64054774defbaa2c6b6b165290d5355
SSDEEP

24:eFGSpNtdz/EWITdPm1MpZ08GPWLvmkVcsiMriuSi9UbxwSaI8rD:iddblIRPmKpZ08GPWekyA/Fywbp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000009bef3d7e78d8ff7d7a294ee83257cc4221b159f5a80a31c915c4498fc15cace000000000e800000000200002000000087a31c3abd4d08b624b2fe44581f918e2a1d7632e3227f314a6c3a7bc09de1d3900000009aedbf84442deaa2e717481534b51ea0a058c0d7bb8fda6dd02fafcc15f4131a03cb5cd6984595790bab0ba5d1d7404c1056cf4bf4d39d87df59875ed2dedd169617fecaafb5fe5ee5f86feacdd4f85199535f5ba71221cec2bd767b72009221cfabfb743883da6a3dbd7d9e19dbf092f6a29647a8c3089234dbfbc246cd61e6f74d163d47e4291dcee201b16cf3538d40000000a014d083fa4be8a0a2f65c3ad9d4574fb893d252a183467f84bf50b3cf199b186843fb323bf8e99b7aaf937a9a9eced05bf2ddc8659652d67db3fb1480037fbf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000865d0b0d42c6c79efadd4b345b6aeed6789329977f6fe17a6bea022d99ca2cd6000000000e80000000020000200000001048730ca571a638cac9418e969946ba70e71ec8532cc9f394a0a6db52b304a0200000008c633fda1523c290cfaf53ea50355bcfdbed25e4eebc5cca6673465e4967b67f40000000776dc9ad5210df5ab28396c2a4fabf8fee28e6d21c1751987bcf3e68950a2bb36940eabf6ad3166f8954bde382025449adb88bb9e79c2177affe0b2fdf189dcb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{507D9BC1-ACC5-11EE-B55C-66F723737CE2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410729266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e60727d240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1996	1216	79d49f5ee6ead95c096d3c186169d47c.exe	28
PID 1216 wrote to memory of 1996	1216	79d49f5ee6ead95c096d3c186169d47c.exe	28
PID 1216 wrote to memory of 1996	1216	79d49f5ee6ead95c096d3c186169d47c.exe	28
PID 1216 wrote to memory of 1996	1216	79d49f5ee6ead95c096d3c186169d47c.exe	28
PID 2084 wrote to memory of 3068	2084	explorer.exe	31
PID 2084 wrote to memory of 3068	2084	explorer.exe	31
PID 2084 wrote to memory of 3068	2084	explorer.exe	31
PID 3068 wrote to memory of 2604	3068	iexplore.exe	29
PID 3068 wrote to memory of 2604	3068	iexplore.exe	29
PID 3068 wrote to memory of 2604	3068	iexplore.exe	29
PID 3068 wrote to memory of 2604	3068	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\79d49f5ee6ead95c096d3c186169d47c.exe
"C:\Users\Admin\AppData\Local\Temp\79d49f5ee6ead95c096d3c186169d47c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" http://www.paladin-select.net/indexx.html
  2⤵
  PID:1996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.paladin-select.net/indexx.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a4245facc920bde587378406df4d5373

SHA1
9379866819fd37c3476340c2b3fb3a3ffc7eeb80

SHA256
6d5dcb45c587e6e3e921996a3d93bf8c810283c29bd1508962e8d12dc55279c1

SHA512
13e68662318c0e672f9b85e8dd966adc606cc4055ac5dcca0807a8d176e66868cb9409254558d3e7d6a009e6fcad81e94817f51b00215fcda9303c4897b3e582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4e3e039758e405ad565461c966d1403d

SHA1
d579e3231c07ac3f43b8ab4f16b4e8e130ecbfa7

SHA256
4808bced9783a31c7b46ef96d93bb91c6629f54b849e0eca2816ecb860567b50

SHA512
f3fd0f37323bf658013b2dc6b159de1fd941f170744adcc3691e067ecf6da9873bf6a91927f3cfeefd291af715a8294d48810690fd3a0f3393441cca4321ae0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d667df5e6a213c2a4f51800f49a12961

SHA1
744ecee8dc31ffb12d80c4a64018fcbefc5259ce

SHA256
b54e2a9fbe2a596940090900abfc522164fe4b206fdeb5e1148ac0e5183e784a

SHA512
18695e90c438133d0c59ba0d0548eb5df1834ddad9d9fa8b04b2915891f97b2fa92030053880691b103b6b04325aa171886ce19fb74179e84e406efc3541db84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
76dfa0cc61d3b631c31edf99fcd4a521

SHA1
042b142c5a4ca6070b4c91176a9c657c7b7190c5

SHA256
6ac4869643c31d312762f3b19fbfc38452f3d5424561450819a40fe04d38329b

SHA512
dcb375cd4a5c1f2b11527a0bc41527f0e5dc2abe91c441e6c923bf55cfec14490dbd595ed97848d6901bf30c4b866d00cd1693ef744c0f3d0b4f6996cfa58144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cfc2d3e4bece7256e69e15d1d336846a

SHA1
d4bc8f82c1f7deaf3488f3cf57f47118a5d322be

SHA256
12d6cd563a1921585364fa7e23c80f724295b01e479d7c68f9950927f773cff5

SHA512
d4a47f3fba2a50e3e3f8f18916e723c9102cc391d83fbfe08ff303353f6df8d9df85ac5582454aa1b24660619c741535a29e6551210b022ed667b7bb76f92aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c17e09c2a0e9951fd92ddd26fa8c8d05

SHA1
25080fa2e1b16a83173b9e2a5f311e1b271cde0c

SHA256
62e2c36633b412d59b30e3b9b32718aa581f601a1b889f5491ad85f278472e94

SHA512
7c3d9260d8b759fe82e3319661431fbd3c8343c7e1b3c6383b9629ac0b3b81ab82e0468447f624be05a6c3e27c114834cadc2632c9f0bbbb33858d6f37a9dd72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f549a64e6d81df79f638acc40a6e644

SHA1
c3d90acea4fd5fa11fc6ff525c3c5d494e86b90b

SHA256
e5377d42423fb732d6e53b8304f640da15342810256c9290eb90a5c3602480c3

SHA512
03d9d1e4a7602ff1adac845cb0717e1fe2387185021721798db3b5564ed8c60b8c92d2279137d743a03cdf2d89c91d34883b8e8fcd19b56893d03854f5cbf0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d7948de5f385b2bdd9b54ada617f234c

SHA1
9a71cad0f06a87683bc9bc36f515e480d774fa3f

SHA256
6ed957765c7348c85ab4d4c12f46921efe9e30f77077efb5a43763adf07e62cb

SHA512
3dbb45dbbbe8db89923dcd2bf8a6b73264c11750cf509bab8bb45117e61fe235f9a7b35111b268cb3a4c22d2e6f0739e64914318c6d0ea806f1a38184e9b79da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F10.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1216-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download